[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-27。"],[[["\u003cp\u003eApigee hybrid utilizes Google Cloud service accounts to execute various tasks, such as sending log and metrics data, pulling trace requests, connecting to the API gateway, executing backups, and downloading proxy bundles.\u003c/p\u003e\n"],["\u003cp\u003eFor enhanced security in production environments, it is recommended to create multiple service accounts, each dedicated to a specific task and possessing a distinct set of permissions, rather than using a single account for all operations.\u003c/p\u003e\n"],["\u003cp\u003eApigee hybrid requires several service accounts for its proper operation, each assigned specific roles, such as \u003ccode\u003eStorage Object Admin\u003c/code\u003e, \u003ccode\u003eCloud Trace Agent\u003c/code\u003e, \u003ccode\u003eLogs Writer\u003c/code\u003e, \u003ccode\u003eApigee Connect Agent\u003c/code\u003e, \u003ccode\u003eMonitoring Metric Writer\u003c/code\u003e, \u003ccode\u003eApigee Synchronizer Manager\u003c/code\u003e, \u003ccode\u003eApigee Analytics Agent\u003c/code\u003e, or \u003ccode\u003eApigee Runtime Agent\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003ecreate-service-account\u003c/code\u003e tool is recommended for creating service accounts, as it automatically assigns the required roles and downloads the service account keys to the local machine.\u003c/p\u003e\n"],["\u003cp\u003eFor non-production, test, or demo environments, a single service account with all required roles can be used, but it is not recommended for production environments, and reusing the name of a deleted service account may result in unexpected behavior.\u003c/p\u003e\n"]]],[],null,["# About service accounts\n\n| You are currently viewing version 1.5 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nA *service account* is a special type of account in Google Cloud that enables components\nand applications of a system to interact with each other and with other APIs. For more information\nabout Google Cloud, see [About Google Cloud services](/apigee/docs/hybrid/v1.5/what-is-hybrid#about-gcp).\n| **SERVICE ACCOUNT FACTOID** \n| Google Cloud projects have a limit of 100 service accounts---including the default service accounts (if any).\n\nApigee hybrid uses Google Cloud service accounts to perform a variety of tasks, including:\n\n- Send log and metrics data\n- Pull trace requests\n- Connect to API gateway for administrative API requests\n- Execute back ups\n- Download proxy bundles\n\nWhile one service account *could* perform all of these operations, for production\nenvironments Apigee recommends that you create multiple service accounts, each assigned to a\nspecific task and each with its own set of permissions. This enhances security by\ncompartmentalizing access and limiting each service account's scope and access privileges. As with\nuser accounts, these permissions are applied by assigning one or more roles to the service\naccount.\n\nService accounts and roles used by hybrid components\n----------------------------------------------------\n\nTo operate properly, Apigee hybrid requires you to create several service accounts. Each\nservice account requires a specific role or roles that enable it to perform its function.\n\nThe following table describes the service accounts for the hybrid components. The names given for\neach service account are the default names. You can use any names you want, but the names should be\neasy to identify with each account's purpose.\n\n\nAs an alternative, for nonproduction, test, and demo environments, you can use a single service\naccount with all the roles assigned to it. This is not recommended for production environments.\n\nIn addition to creating the service accounts listed in this table, you will use each accounts\nprivate keys to generate access tokens so that you can access the Apigee APIs. The\n`create-service-account` tool automaticallyl downloads the key files into a directory\non your local machine when it creates or updates the service accounts.\n\nCreate the service accounts\n---------------------------\n\n| **Deleting and recreating service accounts:** Note that reusing the name of a deleted service account might result in unexpected behavior. If you create a service account and delete it, always recreate it with a unique name. For details, see [Deleting and recreating service accounts](/iam/docs/service-account-overview#deleting-recreating).\n\nThere are several ways to create service accounts, including:\n\n- (*Recommended* ) [`create-service-account` tool](#tool)\n- [Google Cloud console](#gcp)\n- [gcloud SDK](#gcloud)\n\nEach of these is described in the following sections.\n\n### Use the `create-service-account` tool\n\nThe `create-service-account` tool is available after you\n[download and expand `apigeectl`](/apigee/docs/hybrid/v1.5/install-download-install) in the\n`tools/` directory. It hybrid component-specific service accounts and assigns\nthe required roles for you. The tool also automatically downloads the service account keys and\nstores them on your local machine.\n\nFor example, the following command will create all the separate individual service accounts for a\nproduction environment, assign the appropriate IAM roles to each service account, and download\neach accounts private key file to the `./service-accounts` directory: \n\n```\n./tools/create-service-account --env prod\n```\n\n\nThe following command creates a single service account named `apigee-non-prod` with all IAM\nroles for all hybrid components,\nsuitable for demo and test environments, but not for production environments: \n\n```\n./tools/create-service-account --env non-prod\n```\n\nFor more information on using `create-service-account`, see\n[create-service-account reference](/apigee/docs/hybrid/v1.5/create-service-account).\n\n### Use the Google Cloud console\n\nYou can create service accounts with the Google Cloud console.\n\n\nComplete the following steps for each service account listed in [Service\naccounts and roles used by hybrid components](#recommended-sas).\n| **Note:** To create service accounts in the Google Cloud console, you must have the Service Account Admin role (`roles/iam.serviceAccountAdmin`) or another role with the `iam.serviceAccounts.create` permission.\n\n**To create a service account with the Google Cloud console and generate a key for the\nservice account, do the following:**\n\n1. Create a service account:\n\n 1. In the Cloud console, go to the **Service Accounts** page.\n\n [Go to\n Service Accounts](https://console.cloud.google.com/iam-admin/serviceaccounts)\n 2. Select your project.\n 3. Click add**Create Service Account**.\n 4.\n In the **Service account name** field, enter a name. The\n Cloud console fills in the **Service account ID** field based on\n this name.\n\n\n Apigee recommends that you use a name that reflects the service account's role; you\n can set the name of the service account to be the same name as the component that uses it.\n For example, set the name of the Logs Writer service account `apigee-logger`.\n\n\n For more information about the service accounts names and roles, see\n [Service accounts and roles used by hybrid components](#recommended-sas).\n 5. Optional: In the **Service account description** field, enter a description for the service account. Descriptions are helpful at reminding you what a particular service account is used for.\n 6. Click **Create and continue**.\n 7.\n Click the **Select a role** field and select a role, as described in\n [Service accounts and roles used by hybrid components](#recommended-sas). If\n the Apigee roles do not appear in the drop down list, refresh the page.\n\n For example, for the logging component, select the Logs Writer role.\n\n\n If necessary, enter text to filter the list of roles by name. For example, to list only\n the Apigee roles, enter `Apigee` in the filter field.\n\n\n You can add more than one role to a service account, but Apigee recommends that\n you only use one role for each of the recommended service accounts. To change the roles of\n a service account after you have created it, use the **IAM**\n page in the Cloud console.\n | **Note:** If you do not see the roles listed in [Recommended service accounts](#recommended-sas), check with your Apigee account representative to be sure that your account was properly configured and that your organization was provisioned.\n 8. Click **Done** to finish creating the service account.\n\n Do not close your browser window. You will use it in the next step.\n2. Download a JSON key for the service account you just created:\n\n 1. In the Cloud console, click the email address for the service account that you created.\n 2. Click **Keys**.\n 3. Click **Add key** , then click **Create new key**.\n 4. Click **Create**. A JSON key file is downloaded to your computer.\n\n\n Make sure to store the key file securely, because it can be used to\n authenticate as your service account. You can move and rename this file\n however you would like.\n\n\n You will later use some of the service account keys to configure hybrid runtime services.\n For example, when you configure the hybrid runtime, you will specify the location of the\n service account keys using the \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e`.serviceAccountPath`\n properties.\n\n\n These keys are used by the service accounts to get access tokens, which the service\n account then uses to make requests against the Apigee APIs on your behalf. (But that's not\n for a while yet; for now, just remember where you saved it.)\n 5. Click **Close**.\n\nAfter you create a service account, if you want to add or remove a role to it, you must use\nthe **IAM** page in the Cloud console. You cannot manage roles for service\naccounts in the **Service accounts** view.\n| **Tip:** Apigee hybrid includes a validator that checks your service accounts' key files and permissions when [apigeectl](/apigee/docs/hybrid/v1.5/cli-reference) applies the Apigee hybrid runtime components to your cluster. This validation is enabled by default. For more information, see [Service account\n| validation](/apigee/docs/hybrid/v1.5/sa-validation).\n\n### Use the gcloud service account creation APIs\n\nYou can create and manage service accounts with the Cloud Identity and Access Management API.\n\nFor more information, see\n[Creating\nand managing service accounts](/iam/docs/creating-managing-service-accounts).\n\nTroubleshooting\n---------------\n\n| **Deleting and recreating service accounts:** Note that reusing the name of a deleted service account, might result in unexpected behavior. If you create a service account and delete it, always recreate it with a unique name. For details, see [Deleting and recreating service accounts](/iam/docs/service-account-overview#deleting-recreating)."]]
